Privacy Policy

This policy explains what Skillhash collects, why, and what you can do about it.

What we collect

• Account data: email, name and avatar URL. If you sign in with GitHub or Google, we receive these from the provider. We never receive your GitHub or Google password.
• Team data: team names, members, roles, settings, API token metadata (we store only a hash of each token) and the audit log.
• Content: skills you publish to your registry, archives you upload for scanning, sources you watch and the resulting reports.
• Technical data: IP address and request logs, used for security and rate limiting and kept for up to 30 days.
• Billing: handled by Dodo Payments. We receive your customer and subscription IDs and plan status, never your card details.

What the CLI sends

Local commands (scan, lock, install, verify) talk only to GitHub to download the sources you list. Nothing goes to Skillhash unless you run login, push or install a registry: source.

How we use data

To provide and secure the Service, send alerts you configure, process payments and answer support requests. We do not sell personal data and do not use your private skills to train models.

Cookies

We use a single session cookie to keep you signed in and a short-lived cookie during sign-in. No advertising or third-party tracking cookies.

Processors

Oracle Cloud (hosting), Dodo Payments (billing), GitHub and Google (optional sign-in), Slack (only if you add a webhook).

Your rights

You can request access, correction, export or deletion of your data by emailing mr.xazratbek@gmail.com. We respond within 30 days. Public scan reports of public repositories may remain in the directory because they describe public code, but we remove your account link from them on request.

Changes

We will post updates here and email account owners about material changes.